Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between BookMyNails ("Processor", "we", "us") and the salon owner ("Controller", "you") who uses the BookMyNails platform at bookmynails.ca.

This DPA sets out the terms under which BookMyNails processes personal data on behalf of salon owners, in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

• Data Controller — The salon owner who determines the purposes and means of processing personal data of their customers. You decide what data to collect and why.
• Data Processor — BookMyNails, which processes personal data on behalf of the Data Controller to provide the platform's services.
• Data Subject — An identifiable individual whose personal data is processed (e.g., salon customers who book appointments).
• Personal Data — Any information about an identifiable individual, as defined under PIPEDA.
• Processing — Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• Sub-processor — A third-party service provider engaged by BookMyNails to assist in processing personal data.

3.1 Categories of Data Subjects

• Salon customers who book appointments
• Salon owners and staff members

3.2 Types of Personal Data Processed

• Contact information: names, email addresses, phone numbers
• Booking data: appointment history, service preferences, notes
• Communication data: SMS messages, email confirmations, marketing preferences
• Payment data: transaction records (full payment card details are processed by Stripe and never stored by BookMyNails)
• Technical data: IP addresses, browser information, usage logs

3.3 Purpose of Processing

• Providing and operating the booking platform
• Sending booking confirmations, reminders, and notifications
• Processing payments on behalf of salon owners
• Sending marketing communications (SMS/email) when consent is obtained
• Generating analytics and reports for salon owners
• Maintaining platform security and preventing fraud

3.4 Duration of Processing

Personal data is processed for the duration of the service agreement between BookMyNails and the salon owner. Upon termination, data is handled in accordance with Section 10 (Data Retention and Deletion) of this DPA.

4.1 General Obligations

• Process personal data only on documented instructions from the Controller, unless required by Canadian law
• Ensure that persons authorized to process personal data have committed themselves to confidentiality
• Implement appropriate technical and organizational security measures
• Not engage another processor (sub-processor) without prior written authorization from the Controller
• Assist the Controller in responding to data subject requests
• Delete or return all personal data upon termination of services, at the Controller's choice
• Make available to the Controller all information necessary to demonstrate compliance

4.2 Security Measures

BookMyNails implements the following security measures to protect personal data:

• Encryption of data in transit (TLS 1.2+) and at rest
• Role-based access controls and multi-factor authentication for staff
• Regular security assessments and vulnerability scanning
• Automated backup and disaster recovery procedures
• Logging and monitoring of access to personal data
• Secure development lifecycle practices

4.3 Confidentiality

BookMyNails ensures that all personnel who have access to personal data are subject to enforceable confidentiality obligations. Access to personal data is limited to personnel who require it to perform their duties.

As the Data Controller, you are responsible for:

• Ensuring that there is a lawful basis for the collection and processing of personal data
• Obtaining all necessary consents from data subjects before collecting their personal data
• Providing clear privacy notices to your customers explaining how their data will be used
• Ensuring that any instructions given to BookMyNails regarding data processing comply with applicable privacy laws
• Complying with CASL requirements before sending commercial electronic messages through the platform
• Responding to data subject access requests, with BookMyNails' assistance as needed
• Notifying BookMyNails promptly of any data protection issues that may affect the processing

BookMyNails uses the following sub-processors to provide its services. By agreeing to this DPA, you authorize the use of these sub-processors:

BookMyNails will notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object. Each sub-processor is bound by data protection obligations no less protective than those in this DPA.

Under PIPEDA, data subjects have the right to:

• Access — Request a copy of the personal data held about them
• Correction — Request correction of inaccurate or incomplete personal data
• Deletion — Request deletion of their personal data, subject to legal retention requirements
• Portability — Request their data in a structured, commonly used format
• Withdrawal of Consent — Withdraw consent for processing at any time
• Complaint — File a complaint with the Office of the Privacy Commissioner of Canada

BookMyNails will assist the Controller in responding to data subject requests within 30 days, as required by PIPEDA. Salon owners can manage customer data directly through the BookMyNails dashboard, or contact us for assistance.

In the event of a personal data breach, BookMyNails will:

• Notify the affected salon owner(s) within 72 hours of becoming aware of the breach
• Provide details of the nature of the breach, categories of data affected, and approximate number of data subjects affected
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach and mitigate its effects
• Cooperate with the Controller in notifying data subjects and the Office of the Privacy Commissioner of Canada, as required under PIPEDA's mandatory breach reporting provisions

Under PIPEDA's breach of security safeguards provisions, organizations must report breaches that create a real risk of significant harm to the Privacy Commissioner and notify affected individuals.

• Personal data is retained for as long as the salon owner's account is active and as needed to provide services
• Upon account termination, BookMyNails will delete or anonymize personal data within 90 days, unless retention is required by law
• Salon owners may request data export before account termination through the dashboard or by contacting support
• Backup copies are purged within 30 days after primary data deletion
• Payment transaction records may be retained for up to 7 years as required by Canadian tax law
• Aggregated, anonymized data that cannot identify individuals may be retained indefinitely for analytics purposes

Some of our sub-processors are based in the United States. When personal data is transferred outside of Canada, BookMyNails ensures that:

• Transfers comply with PIPEDA's requirements for cross-border data transfers
• Sub-processors are bound by contractual obligations providing a comparable level of protection
• Data is encrypted in transit and at rest
• We have conducted due diligence on each sub-processor's privacy and security practices

Under PIPEDA, organizations may transfer personal data to a third party in another jurisdiction for processing, provided that they use contractual or other means to ensure a comparable level of protection.

This DPA remains in effect for the duration of the service agreement. Upon termination:

• BookMyNails will cease processing personal data on behalf of the Controller
• At the Controller's election, BookMyNails will delete or return all personal data
• BookMyNails will provide certification of data deletion upon request
• Obligations of confidentiality survive termination

BookMyNails is committed to complying with PIPEDA's 10 fair information principles:

• Accountability — We are responsible for personal data in our possession
• Identifying Purposes — We identify the purposes for data collection before or at the time of collection
• Consent — We require knowledge and consent for data collection, use, and disclosure
• Limiting Collection — We collect only what is necessary for identified purposes
• Limiting Use, Disclosure, and Retention — Data is used only for the purposes for which it was collected
• Accuracy — We keep personal data accurate, complete, and up-to-date
• Safeguards — We protect personal data with appropriate security safeguards
• Openness — We make our policies and practices available to individuals
• Individual Access — Individuals can request access to their personal data
• Challenging Compliance — Individuals can challenge our compliance with these principles

For questions about this Data Processing Agreement or to exercise your rights:

You may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca if you have concerns about our data processing practices.